Specifications

© 2006 Cisco Systems, Inc.
All rights reserved.
Product Features 2-110
NAM / Traffic Analyzer v3.5 Tutorial
© 2006 Cisco Systems, Inc. All rights reserved.
Product Features 2-110
NAM / Traffic Analyzer v3.5 Tutorial
Configuring Alarms
Overview
Configuring Alarms
Overview
Do I measure
the condition
by delta or
absolute
values?
What is an
alarm and how
do I use
thresholds to
define an
alarm?
How do I let
others know
about failures
on my
network?
Configuring Alarms Overview
Configuring alarms is serious business. This is because alarms are what network managers and engineers
rely on to notify them when network or device performance falls below expectations. Alarms require a careful
analysis of what variables are stored in the MIBs that will inform you of network and device problems and an
equally careful implementation of those alarms. You may want to consider baselining your network to
establish your expectations of normal behavior before you begin defining alarms. Another reason to carefully
consider what alarms you need is because they consume NAM resources, and use of resources obviously
can affect NAM performance. Before we get into the details of alarm configuration, let’s review some
terminology.
Alarm: An alarm is the condition that identifies when network or device performance falls below defined or
normal expectations. You use thresholds (rising, falling, or both) to define the boundaries of your
expectations. You set thresholds against MIB variables and with the NAM, you can set thresholds against
RMON variables. There are different kinds of variables in MIBs, but the most common type you will encounter
on the NAM is a counter variable. Counter variables work by incrementing the value in the MIB variable by
one each time it sees a match for the variable. For example, if we use the variable Broadcast Packets, then
every time the NAM receives a broadcast packet, it will increment the counter by 1. One way to use alarms
with counter variables is to measure the difference (delta) between the value of the variable at the start and at
the end of the sampling interval, thus reporting only the number of packets observed during the sampling
interval. The other option for evaluating the data is by using the absolute value of the variable when it was
read. For example, if the MIB variable for Broadcasts Packets had an absolute value of 33874 when sampled,
then the NAM will report 33874 broadcast packets since the MIB variable was last cleared.
Event: An event is the actual occurrence of the condition you have defined in your alarm, such as when the
network performance falls below your expectations. An event occurrence is stored in the MIB and is used for
alarm reporting.
Trap: A trap is an SNMP message generated by the SNMP agent in the device that observed the event and
is sent to the management station that has been configured to receive these traps.